fix(ci): stop docker-merge from writing a broken GHCR manifest index - #943
Conversation
…t index The "Annotate manifest with description" step re-ran imagetools create, copying sub-manifests from the tag the previous step had just written instead of from their original per-platform digests, purely to attach an index-level description annotation. That self-referential copy left GHCR with an index whose child manifests (platform images and build attestations) never durably landed, so any pull of the tag failed with "manifest unknown" even though imagetools inspect reported success. Fold the annotation into the single, original imagetools create call instead of re-copying through the tag. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe Docker workflow now passes Poem
Merge Risk: ⚪ Minimal · up to This localized CI-only change folds the OCI annotation into the original manifest creation step to avoid producing broken GHCR indexes; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…944) * fix(ci): stop docker-cleanup from deleting other PRs' live manifests The cleanup job's "delete every untagged version" step assumed untagged versions were always orphans of the closing PR's own image. In fact a multi-arch manifest list never tags its per-platform children or attestation manifests -- only the top-level index carries the tag -- so every other open PR's pr-N tag depends on untagged versions the same way. Closing any PR wiped the still-referenced children of every other PR's image, which is why a freshly rebuilt pr-942 kept coming back broken even after fixing the docker-merge job in #943. Only delete an untagged version once no remaining tag's manifest index references its digest, and only once it's old enough (10 minutes) that a concurrent docker-merge run for another PR isn't mistaken for an orphan before it tags its index. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): fail closed on registry errors in docker-cleanup The reference-collection loop and the GHCR token fetch swallowed curl failures silently: an empty/failed response fed into jq produced no output but exited 0, so a single transient registry error degraded "is this manifest referenced" into a false negative -- causing the deletion loop to delete a still-live tag's children, the exact failure mode this fix exists to prevent. Check the token is non-empty and abort on any manifest fetch failure. The fetch loop moves from a pipe to a process substitution so `exit 1` inside it terminates the step instead of just the subshell a pipe would create. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Summary
docker-mergein.github/workflows/docker.ymlrandocker buildx imagetools createtwice for GHCR PR images: once to build the multi-arch index from the per-platform digests, then again to attach anindex:org.opencontainers.image.descriptionannotation — but the second call sourced its sub-manifests from the tag the first call had just written, instead of from the original digests.linux/amd64/linux/arm64images and their build attestations) never durably landed.docker buildx imagetools inspectstill reported success (it only reads the index), but any real pull failed withmanifest unknown— confirmed onghcr.io/hanzei/jot:pr-942, where all four child manifest digests 404 by themselves.imagetools createcall instead of re-copying through the tag.release.yml(Docker Hub) doesn't have this second annotate step and is unaffected.No app code changed — CI workflow only, no visual artifact.
Test plan
docker.ymlrun on a PR produces apr-<N>GHCR tag whose per-platform manifests are pullable (not justimagetools inspect-visible)